A critical command injection vulnerability in the Fleet Orbit agent allows local unprivileged users to achieve full root escalation.

The vulnerability exists within the Orbit agent's FileVault disk encryption key rotation process, where unsanitized user passwords are passed into a Tcl/expect script. An attacker with local access can inject arbitrary Tcl commands, which execute with root privileges due to the agent's elevated operating context.

The ability for a local user to escalate to root privileges represents a total compromise of the affected device's security model. With a CVSS score of 7.8, this flaw poses a significant risk to organizational assets, as it enables unauthorized administrative access, potential data exfiltration, and the ability to bypass all local security controls.

Immediate Action: Update the Fleet Orbit agent to version 4.81.1 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Review system logs for unusual process execution patterns or suspicious Tcl/expect command invocations originating from the Orbit agent.

Compensating Controls: Restrict local shell access for untrusted users on systems running the Fleet agent to prevent the initial interaction required to trigger the injection.

Public Exploit Available: Unknown

This vulnerability presents a high risk to the integrity of managed devices because it allows for trivial privilege escalation. Administrators should prioritize the deployment of the 4.81.1 update across all managed endpoints to neutralize the injection vector and maintain the security posture of the device management infrastructure.